Our approach is to validate user identity at all times by continuously monitoring keystrokes. Each keystroke is captured through by way of the X-windows server and processed either to train the model or to compute a probability that the current user is the same as the user on whom the model was trained.
We are using the keystroke delays to set up a structure similar to a Markov chain which models the mean and variance of the delay between two keystrokes. We take all the combinations of 2 subsequent keys and store the data as a user profile. To identify a user we check which user's model maximizes the likelihood of the recent key-presses.